Insecure Windows Service Permissions

Overview

This page outlines the vulnerability associated with insecure permissions on Windows services, where services configured with overly permissive access rights can lead to unauthorized modifications, including privilege escalation. This issue is particularly critical when non-administrative users or processes are granted 'Modify' (M) or 'Full Access' (F) rights to service executables.

• Severity: High

Impact

Exploiting insecure service permissions can enable attackers to modify service binaries or configurations, allowing for the execution of arbitrary code with elevated privileges. This can lead to full system compromise, data theft, and persistent access to the affected system.

Cause

The vulnerability is caused by inadequate permission settings on service executables or directories, where non-privileged users or groups (like Builtin Users) are granted extensive control (Modify or Full Access) over service files.

Solution

Securing Service Permissions: To mitigate this vulnerability, restrict service file permissions to prevent unauthorized changes.

1. Review Current Permissions: Use the `icacls` command to view current permissions on service executables:

   icacls "path\to\service\executable.exe" 2>nul

2. Restrict Permissions:

   Ensure that only administrative accounts have write access to service executables and configuration files. Use the following command to modify permissions securely:

   icacls "path\to\service\executable.exe" /grant "Administrators:F" /remove "Builtin\Users"

3. Automate Permission Audits:

   Use scripting to periodically check and correct permissions across all services:

   for/f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\\windows\\temp\\permissions.txt
   for/f eol^=^"^ delims^=^" %a in (c:\\windows\\temp\\permissions.txt) do cmd.exe /c icacls "%a"

Examples

N/A

References

• Windows Privilege Escalation - Weak Permission - Stefhttlan's Security Blog

Additional Resources

• Travis Altman's Guide on Service Permission Exploits
• Microsoft Documentation on Service Security and Access Rights